What changed in Microsoft Exchange 2019 Edge Server STIG V2R3V2R3 changes

Title

Exchange servers must use approved DODoW certificates.

Check text

Open the Exchange Management Shell and enter the following command: Get-ExchangeCertificate | Select-Object -Property CertificateDomains, issuer If the value of "CertificateDomains" does not indicate it is issued by the DODDoW, this is a finding.

Fix text

Remove the non-DODoW certificate and import the correct DODoW certificates.

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DODDoW-approved PKIs, all DODDoW systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. This requirement is applicable to access control enforcement applications (e.g., authentication servers) and other applications that perform information and system access control functions.

V-259578 in V2R3

Check text

If the exchange server uses DomainValidation, this requirement is Not Applicable. Open the Exchange Management Shell and enter the following command: Get-SendConnector | Select-Object -Property Name, Identity, DomainSecureEnabled For each send connector, if the value of "DomainSecureEnabled" is not set to "True", this is a finding. If the "TlsAuthLevel" parameter is set to "DomainValidation" then the "TlsDomain" parameter is required if "DNSRoutingEnabled" parameter is set to "$false". The "DNSRoutingEnabled" parameter must be "$true" If the value of "DomainSecureEnabled" is "$true".

V-259594 in V2R3

Discussion

Email system availability depends in part on best practice strategies for setting tuning configurations. This configuration controls the maximum number of recipients who will receive a copy of a message at one time. This tunable value is related to throughput capacity and can enable the ability to optimize message delivery. Note: There are two types of default receive connecters: "Client Servername" accepts SMTP connections from all non-MAPI clients, such as POP and IMAP. As POP and IMAP are not authorized for use in DODDoW, these should not be present. Their default value for MaxRecipientsPerMessage is 200. IMAP Secure is not restricted and may be configured. "Default Servername" accepts connections from other mailbox servers and any Edge Transport servers. Their default value for MaxRecipientsPerMessage is 5000.

V-259600 in V2R3

Check text

Note: If using another DODDoW-approved anti-spam product for email or a DODDoW-approved Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is notNot applicableApplicable. Note: If system is on SIPRNet, this is notNot applicableApplicable. Review the Email Domain Security Plan (EDSP). Determine the name of the Transport Agent. Open the Windows PowerShell console and enter the following command: Get-TransportAgent -Name 'customAgent' | Format-List If the value does not return "customAgent", this is a finding. Note: "customAgent" is the name of the custom agent developed to render hyperlink email sources from non .mil domains as unclickable.

V-259608 in V2R3

Check text

This requirement is Not Applicable for SIPR enclaves. This requirement is Not Applicable if the organization subscribes to EEMSG or other similar DODDoW enterprise protections for email services. Open the Exchange Management Shell and enter the following command: Get-SenderFilterConfig | Select-Object -Property Name, Action If the value of "Action" is not set to "Reject", this is a finding. Note: "Reject" is the default value.

V-259609 in V2R3

Check text

This requirement is Not Applicable for SIPR enclaves. This requirement is Not Applicable if the organization subscribes to EEMSG or other similar DODDoW enterprise protections for email services. Open the Exchange Management Shell and enter the following command: Get-SenderFilterConfig | Select-Object -Property Name, BlankSenderBlockingEnabled If the value of "BlankSenderBlockingEnabled" is not set to "True", this is a finding.

V-259610 in V2R3

Check text

This requirement is not applicable for SIPR enclaves. This requirement is not applicable if the organization subscribes to EEMSG or other similar DODDoW enterprise protections for email services. Open the Exchange Management Shell and enter the following command: Get-SenderFilterConfig | Select-Object -Property Name, Enabled If the value of "Enabled" is not set to "True", this is a finding. Note: "Enabled" set to "True" is the default value.

V-259625 in V2R3

Check text

Review the Email Domain Security Plan (EDSP) for an installed anti-spam product. Note: If using another DODDoW-approved anti-spam product for email or a DODDoW-approved Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable. Open the Exchange Management Shell and enter the following command: Get-ContentFilterConfig | Format-Table Name, Enabled If no value is returned, this is a finding.

V-259626 in V2R3

Check text

Review the Email Domain Security Plan (EDSP) for an installed anti-spam product. Note: If using another DODDoW-approved anti-spam product for email or a DODDoW-approved Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable. Open the Exchange Management Shell and enter the following command: Get-ContentFilterConfig | Format-Table Name, Enabled; Get-SenderFilterConfig | Format-Table Name, Enabled; Get-SenderIDConfig | Format-Table Name, Enabled; Get-SenderReputationConfig | Format-Table Name, Enabled If any of the following values returned are not set to "True", this is a finding: Set-ContentFilterConfig Set-SenderFilterConfig Set-SenderIDConfig Set-SenderReputationConfig

V-259627 in V2R3

Check text

The site should use an approved DODDoW scanner as Exchange Malware software has a limited scanning capability. If an approved DODDoW scanner is not being used, this is a finding.

Fix text

Following vendor best practice guidance, install and configure a DODoW approved scanner.

V-259628 in V2R3

Check text

If the exchange server uses mTLS, this requirement is Not Applicable. Open the Exchange Management Shell and enter the following command: Get-SendConnector | Select-Object -Property Name, Identity, TlsAuthLevel If the value of "TlsAuthLevel" is not set to "DomainValidation", this is a finding.

V-259639 in V2R3

Check text

Note: If using another DODDoW-approved anti-spam product for email or a DODDoW-approved Email Gateway spamming device, such as Enterprise Email Security Gateway (EEMSG), this is not applicable. Note: If system is on SIPRNet, this is not applicable. Review the Email Domain Security Plan (EDSP). Determine the name of the Transport Agent. Open the Windows PowerShell console and enter the following command: Get-TransportAgent -Name 'customAgent' | Format-List If the value does not return "customAgent", this is a finding. Note: "customAgent" is the name of the custom agent developed to render hyperlink email sources from non .mil domains as unclickable.

V-259643 in V2R3